To complement the LPIPS robustness evaluation in Fig. REF , we also report the \(\operatorname{\mathbf {\ell }}_2\)  robustness of the same set of models in Fig. REF : standard, \(\operatorname{\mathbf {\ell }}_2\)  AT, Fast perceptual AT, and RLAT models with their main hyperparameters selected to perform best on common corruptions. We evaluate \(\operatorname{\mathbf {\ell }}_2\)  robustness using the APGD-CE attack with 100 iterations and 5 random restarts [1]} for different \(\operatorname{\mathbf {\ell }}_2\)  radii \(\operatorname{\mathbf {\varepsilon }}\in \lbrace 0.05, 0.1, 0.25, 0.5\rbrace \) . We observe that all three adversarial training methods improve the \(\operatorname{\mathbf {\ell }}_2\)  robustness substantially compared to the standard model.
